arXiv subjects

Alessandro E. C. Redondi

Publications and source records attributed to Alessandro E. C. Redondi.

15 recordsLinked to original sources

arXiv2026

Early-Stage IoT Device Identification Using Passive Network Traffic Analysis

The rapid proliferation of Internet of Things (IoT) devices introduces significant security challenges due to limited visibility and weak device-level guarantees. Accurate and timely identification of devices is essential for enforcing network policies and detecting unauthorised hardware, yet existing approaches often rely on long-term traffic observation, payload inspection, or infrastructure-dependent features. In this paper, we investigate whether IoT devices can be reliably identified during the early stages of network attachment using only passive traffic analysis. We propose a lightweight approach based on flow-level features extracted from metadata, avoiding payload inspection and active probing. Through systematic evaluation across multiple observation windows, we show that device-specific signatures emerge within the first few seconds of communication, enabling high-accuracy identification (up to 99%) across 37 IoT devices. Notably, extending the observation window does not consistently improve performance and may slightly degrade accuracy, indicating that the most discriminative behaviour occurs during initial device startup. These findings demonstrate the feasibility of fast, privacy-preserving IoT device identification at the network edge, supporting real-time enforcement, device inventory, and anomaly detection in practical deployments.

cs.NI↗

arXiv2026

Zigbee vs. Matter over Thread: Understanding IoT Protocol Performance in Practice

The widespread adoption of the Internet of Things (IoT) has positioned smart homes as paradigmatic examples of distributed automation systems, where reliability, efficiency, and interoperability depend critically on the underlying communication protocol. Among the low-power wireless technologies available for this scenario, Zigbee and Matter over Thread have emerged as leading contenders. While Zigbee represents a mature, non-IP mesh networking solution, Matter over Thread introduces an IP-based architecture designed to unify device interoperability across different ecosystems. However, despite extensive documentation of their design principles, there is a lack of empirical, comparative performance data under realistic network conditions. This paper presents a comprehensive experimental comparison between the two protocols, conducted on a testbed built from commercially available hardware. The proposed methodology focuses on different key performance dimensions, such as scalability, responsiveness, and fault tolerance. The results reveal that Zigbee achieves a lower baseline overhead and faster route recovery, making it more responsive in static small-scale deployments. Matter over Thread, conversely, exhibits superior scalability and robustness, maintaining stable throughput and predictable latency across multi-hop scenarios. Overall, we highlight that Zigbee and Matter over Thread embody distinct trade-offs between agility, efficiency, and scalability.

cs.NI↗

arXiv2026

Lossy Compression of Network Feature Data: When Less Is Enough

Network traffic analysis increasingly relies on feature-based representations to support monitoring and security in the presence of pervasive encryption. Although features are more compact than raw packet traces, their storage has become a scalability bottleneck from large-scale core networks to resource-constrained Internet of Things (IoT) environments. This article investigates task-aware lossy compression strategies that reduce the storage footprint of traffic features while preserving analytics accuracy. Using website classification in core networks and device identification in IoT environments as representative use cases, we show that simple, semantics-preserving compression techniques expose stable operating regions that balance storage efficiency and task performance. These results highlight compression as a first-class design dimension in scalable network monitoring systems.

cs.NI↗

arXiv2026

Analyzing Zigbee Traffic: Datasets, Classification and Storage Trade-offs

Zigbee is widely used in smart home environments due to its low power consumption and support for mesh networking, making it a relevant target for traffic-based IoT forensic analysis. However, existing studies often rely on limited datasets and fixed network configurations. In this paper, we analyze Zigbee network traffic from three complementary perspectives: data collection, traffic classification, and storage efficiency. We introduce ZIOTP2025, a publicly available dataset of Zigbee traffic collected from commercial smart home devices deployed under multiple network configurations and capturing realistic interaction scenarios. Using this dataset, we study two traffic classification tasks: device type classification and individual device identification, and evaluate their robustness under both intra-configuration and cross-configuration settings. Our results show that while high classification accuracy can be achieved under controlled conditions, performance degrades significantly when models are evaluated across different network configurations, particularly for fine-grained identification tasks. Finally, we investigate the trade-off between traffic storage requirements and classification accuracy. We show that lossy compression of traffic features through quantization can reduce storage requirements by approximately 4-5x compared to lossless storage of raw packet traces, while preserving near-lossless classification performance. Overall, our results highlight the need for topology-aware Zigbee traffic analysis and storage-efficient feature compression to enable robust and scalable IoT forensic systems.

cs.NI↗

arXiv2026

Lossy Compression of Cellular Network KPIs

Network Key Performance Indicators (KPIs) are a fundamental component of mobile cellular network monitoring and optimization. Their massive volume, resulting from fine-grained measurements collected across many cells over long time horizons, poses significant challenges for storage, transport, and large-scale analysis. In this letter, we show that common cellular KPIs can be efficiently compressed using standard lossy compression schemes based on prediction, quantization, and entropy coding, achieving substantial reductions in reporting overhead. Focusing on traffic volume KPIs, we first characterize their intrinsic compressibility through a rate-distortion analysis, showing that signal-to-noise ratios around 30 dB can be achieved using only 3-4 bits per sample, corresponding to an 8-10x reduction with respect to 32-bit floating-point representations. We then assess the impact of KPI compression on representative downstream analytics tasks. Our results show that aggregation across cells mitigates quantization errors and that prediction accuracy is unaffected beyond a moderate reporting rate. These findings indicate that KPI compression is feasible and transparent to network-level analytics in cellular systems.

cs.NI↗

arXiv2025

Efficient Wi-Fi Sensing for IoT Forensics with Lossy Compression of CSI Data

Wi-Fi sensing is an emerging technology that uses channel state information (CSI) from ambient Wi-Fi signals to monitor human activity without the need for dedicated sensors. Wi-Fi sensing does not only represent a pivotal technology in intelligent Internet of Things (IoT) systems, but it can also provide valuable insights in forensic investigations. However, the high dimensionality of CSI data presents major challenges for storage, transmission, and processing in resource-constrained IoT environments. In this paper, we investigate the impact of lossy compression on the accuracy of Wi-Fi sensing, evaluating both traditional techniques and a deep learning-based approach. Our results reveal that simple, interpretable techniques based on principal component analysis can significantly reduce the CSI data volume while preserving classification performance, making them highly suitable for lightweight IoT forensic scenarios. On the other hand, deep learning models exhibit higher potential in complex applications like activity recognition (achieving compression ratios up to 16000:1 with minimal impact on sensing performance) but require careful tuning and greater computational resources. By considering two different sensing applications, this work demonstrates the feasibility of integrating lossy compression schemes into Wi-Fi sensing pipelines to make intelligent IoT systems more efficient and improve the storage requirements in forensic applications.

cs.NI↗

arXiv2025

Handling Large-Scale Network Flow Records: A Comparative Study on Lossy Compression

Flow records, that summarize the characteristics of traffic flows, represent a practical and powerful way to monitor a network. While they already offer significant compression compared to full packet captures, their sheer volume remains daunting, especially for large Internet Service Providers (ISPs). In this paper, we investigate several lossy compression techniques to further reduce storage requirements while preserving the utility of flow records for key tasks, such as predicting the domain name of contacted servers. Our study evaluates scalar quantization, Principal Component Analysis (PCA), and vector quantization, applied to a real-world dataset from an operational campus network. Results reveal that scalar quantization provides the best tradeoff between compression and accuracy. PCA can preserve predictive accuracy but hampers subsequent entropic compression, and while vector quantization shows promise, it struggles with scalability due to the high-dimensional nature of the data. These findings result in practical strategies for optimizing flow record storage in large-scale monitoring scenarios.

cs.NI↗

arXiv2024

Compact Probe Request Fingerprinting with Asymmetric Pairwise Boosting

Probe Requests are Wi-Fi management frames periodically sent by devices during network discovery. Tracking Probe Requests over time offers insights into movement patterns, traffic flows, and behavior trends, which are keys in applications such as urban planning, human mobility analysis, and retail analytics. To protect user privacy, techniques such as MAC address randomization are employed, periodically altering device MAC addresses to limit tracking. However, research has shown that these privacy measures can be circumvented. By analyzing the Information Elements (IE) within the Probe Request body, it is possible to fingerprint devices and track users over time. This paper presents a machine learning-based approach for fingerprinting Wi-Fi Probe Requests in a compact fashion. We utilize Asymmetric Pairwise Boosting to learn discriminating filters which are then used to process specific bit sequences in Probe Request frames, and quantize the results into a compact binary format. Extensive evaluation on public datasets demonstrates a two-order-of-magnitude storage reduction compared to existing methods while maintaining robust fingerprinting performance.

cs.NI↗

arXiv2024

A Federated Learning Platform as a Service for Advancing Stroke Management in European Clinical Centers

The rapid evolution of artificial intelligence (AI) technologies holds transformative potential for the healthcare sector. In critical situations requiring immediate decision-making, healthcare professionals can leverage machine learning (ML) algorithms to prioritize and optimize treatment options, thereby reducing costs and improving patient outcomes. However, the sensitive nature of healthcare data presents significant challenges in terms of privacy and data ownership, hindering data availability and the development of robust algorithms. Federated Learning (FL) addresses these challenges by enabling collaborative training of ML models without the exchange of local data. This paper introduces a novel FL platform designed to support the configuration, monitoring, and management of FL processes. This platform operates on Platform-as-a-Service (PaaS) principles and utilizes the Message Queuing Telemetry Transport (MQTT) publish-subscribe protocol. Considering the production readiness and data sensitivity inherent in clinical environments, we emphasize the security of the proposed FL architecture, addressing potential threats and proposing mitigation strategies to enhance the platform's trustworthiness. The platform has been successfully tested in various operational environments using a publicly available dataset, highlighting its benefits and confirming its efficacy.

cs.CY↗

arXiv2024

MAC Address De-Randomization Using Multi-Channel Sniffers and Two-Stage Clustering

MAC randomization is a widely used technique implemented on most modern smartphones to protect user's privacy against tracking based on Probe Request frames capture. However, there exist weaknesses in such a methodology which may still expose distinctive information, allowing to track the device generating the Probe Requests. Such techniques, known as MAC de-randomization algorithms, generally exploit Information Elements (IEs) contained in the Probe Requests and use clustering methodologies to group together frames belonging to the same device. While effective on heterogeneous device types, such techniques are not able to differentiate among devices of identical type and running the same Operating System (OS). In this paper, we propose a MAC de-randomization technique able to overcome such a weakness. First, we propose a new dataset of Probe Requests captured from devices sharing the same characteristics. Secondly, we observe that the time-frequency pattern of Probe Request emission is unique among devices and can therefore be used as a discriminative feature. We embed such a feature in a two-stage clustering methodology and show through experiments its effectiveness compared to state-of-the-art techniques based solely on IEs fingerprinting. The original dataset used in this work is made publicly available for reproducible research.

cs.NI↗

arXiv2023

Collecting Channel State Information in Wi-Fi Access Points for IoT Forensics

The Internet of Things (IoT) has boomed in recent years, with an ever-growing number of connected devices and a corresponding exponential increase in network traffic. As a result, IoT devices have become potential witnesses of the surrounding environment and people living in it, creating a vast new source of forensic evidence. To address this need, a new field called IoT Forensics has emerged. In this paper, we present \textit{CSI Sniffer}, a tool that integrates the collection and management of Channel State Information (CSI) in Wi-Fi Access Points. CSI is a physical layer indicator that enables human sensing, including occupancy monitoring and activity recognition. After a description of the tool architecture and implementation, we demonstrate its capabilities through two application scenarios that use binary classification techniques to classify user behavior based on CSI features extracted from IoT traffic. Our results show that the proposed tool can enhance the capabilities of forensic investigations by providing additional sources of evidence. Wi-Fi Access Points integrated with \textit{CSI Sniffer} can be used by ISP or network managers to facilitate the collection of information from IoT devices and the surrounding environment. We conclude the work by analyzing the storage requirements of CSI sample collection and discussing the impact of lossy compression techniques on classification performance.

cs.NI↗

arXiv2023

Feature-Sniffer: Enabling IoT Forensics in OpenWrt based Wi-Fi Access Points

The Internet of Things is in constant growth, with millions of devices used every day in our homes and workplaces to ease our lives. Such a strict coexistence between humans and smart devices makes the latter digital witnesses of our every-day lives through their sensor systems. This opens up to a new area of digital investigation named IoT Forensics, where digital traces produced by smart devices (network traffic, in primis) are leveraged as evidences for forensic purposes. It is therefore important to create tools able to capture, store and possibly analyse easily such digital traces to ease the job of forensic investigators. This work presents one of such tools, named Feature-Sniffer, which is thought explicitly for Wi-Fi enabled smart devices used in Smart Building/Smart Home scenarios. Feature-Sniffer is an add-on for OpenWrt-based access points and allows to easily perform online traffic feature extraction, avoiding to store large PCAP files. We present Feature-Sniffer with an accurate description of the implementation details, and we show its possible uses with practical examples for device identification and activity classification from encrypted traffic produced by IoT cameras. We release Feature-Sniffer publicly for reproducible research.

cs.NI↗

arXiv2019

Occupancy Estimation Using Low-Cost Wi-Fi Sniffers

Real-time measurements on the occupancy status of indoor and outdoor spaces can be exploited in many scenarios (HVAC and lighting system control, building energy optimization, allocation and reservation of spaces, etc.). Traditional systems for occupancy estimation rely on environmental sensors (CO2, temperature, humidity) or video cameras. In this paper, we depart from such traditional approaches and propose a novel occupancy estimation system which is based on the capture of Wi-Fi management packets from users' devices. The system, implemented on a low-cost ESP8266 microcontroller, leverages a supervised learning model to adapt to different spaces and transmits occupancy information through the MQTT protocol to a web-based dashboard. Experimental results demonstrate the validity of the proposed solution in four different indoor university spaces.

cs.NI↗

arXiv2019

Towards a Scaled IoT Pub/Sub Architecture for 5G Networks: the Case of Multiaccess Edge Computing

The vision of the Internet of Thing is becoming a reality and novel communications technologies such as the upcoming 5G network architecture are designed to support its full deployment. In this scenario, we discuss the benefits that a publish/subscribe protocol such as MQTT or its recently proposed enhancement MQTT+ could bring into the picture. However, deploying pub/sub brokers with advanced caching and aggregation functionalities in a distributed fashion poses challenges in protocol design and management of communication resources. In this paper, we identify the main research challenges and possible solutions to scale up a pub/sub architecture for upcoming IoT applications in 5G networks, and we present our perspective on systems design, optimisation, and working implementations.

cs.DC↗

arXiv2018

MQTT+: Enhanced Syntax and Broker Functionalities for Data Filtering, Processing and Aggregation

In the last few years, the Message Queueing Telemetry Transport (MQTT) publish/subscribe protocol emerged as the de facto standard communication protocol for IoT, M2M and wireless sensor networks applications. Such popularity is mainly due to the extreme simplicity of the protocol at the client side, appropriate for low-cost and resource-constrained edge devices. Other nice features include a very low protocol overhead, ideal for limited bandwidth scenarios, the support of different Quality of Services (QoS) and many others. However, when an edge device is interested in performing processing operations over the data published by multiple clients, the use of MQTT may result in high network bandwidth usage and high energy consumption for the end devices, which is unacceptable in resource constrained scenarios. To overcome these issues, we propose in this paper MQTT+, which provides an enhanced protocol syntax and enrich the pub/sub broker with data filtering, processing and aggregation functionalities. MQTT+ is implemented starting from an open source MQTT broker and evaluated in different application scenarios.

cs.NI↗